Loki detected_fields query limits results in unbounded memory allocation
Medium
| Advisory ID: | CVE-2026-21729 |
| Published: | 2026-07-15 |
| Product: | Loki |
| CVSS Score: | 7.5 |
| CVSS Vector: | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Fixed Versions: | >=3.7.0 |
Summary
The Loki detected_fields endpoint allocates 2*limit elements in slices and maps based on the user-supplied limit query parameter, regardless of actual result count. A massive limit value (e.g. 600000000) allocates 20-30 GiB even with zero matching results, causing OOM, resulting in denial of service.